strongimcv_pki---gen(1) [centos man page]
PKI --GEN(1) strongSwan PKI --GEN(1) NAME
pki --gen - Generate a new RSA or ECDSA private key SYNOPSIS
pki --gen [--type type] [--size bits] [--safe-primes] [--shares n] [--threshold l] [--outform encoding] [--debug level] pki --gen --options file pki --gen -h | --help DESCRIPTION
This sub-command of pki(1) is used to generate a new RSA or ECDSA private key. OPTIONS
-h, --help Print usage information with a summary of the available options. -v, --debug level Set debug level, default: 1. -+, --options file Read command line options from file. -t, --type type Type of key to generate. Either rsa or ecdsa, defaults to rsa. -s, --size bits Key length in bits. Defaults to 2048 for rsa and 384 for ecdsa. For ecdsa only three values are currently supported: 256, 384 and 521. -p, --safe-primes Generate RSA safe primes. -f, --outform encoding Encoding of the generated private key. Either der (ASN.1 DER) or pem (Base64 PEM), defaults to der. RSA Threshold Cryptography -n, --shares <n> Number of private RSA key shares. -l, --threshold <l> Minimum number of participating RSA key shares. PROBLEMS ON HOSTS WITH LOW ENTROPY
If the gmp plugin is used to generate RSA private keys the key material is read from /dev/random (via the random plugin). Therefore, the command may block if the system's entropy pool is empty. To avoid this, either use a hardware random number generator to feed /dev/random or use OpenSSL (via the openssl plugin or the command line) which is not as strict in regards to the quality of the key material (it reads from /dev/urandom if necessary). It is also possible to configure the devices used by the random plugin in strongswan.conf(5). Setting libstrongswan.plugins.random.random to /dev/urandom forces the plugin to treat bytes read from /dev/urandom as high grade random data, thus avoiding the blocking. Of course, this doesn't change the fact that the key material generated this way is of lower quality. EXAMPLES
pki --gen --size 3072 > rsa_key.der Generates a 3072-bit RSA private key. pki --gen --type ecdsa --size 256 > ecdsa_key.der Generates a 256-bit ECDSA private key. SEE ALSO
pki(1) 5.1.1 2013-07-31 PKI --GEN(1)
Check Out this Related Man Page
PKI(1) strongSwan PKI(1) NAME
pki - Simple public key infrastructure (PKI) management tool SYNOPSIS
pki command [option ...] pki -h | --help DESCRIPTION
pki is a suite of commands that allow you to manage a simple public key infrastructure (PKI). Generate RSA and ECDSA key pairs, create PKCS#10 certificate requests containing subjectAltNames, create X.509 self-signed end-entity and root CA certificates, issue end-entity and intermediate CA certificates signed by the private key of a CA and containing subjectAltNames, CRL distribution points and URIs of OCSP servers. You can also extract raw public keys from private keys, certificate requests and certifi- cates and compute two kinds of SHA-1-based key IDs. COMMANDS
-h, --help Prints usage information and a short summary of the available commands. -g, --gen Generate a new private key. -s, --self Create a self-signed certificate. -i, --issue Issue a certificate using a CA certificate and key. -c, --signcrl Issue a CRL using a CA certificate and key. -r, --req Create a PKCS#10 certificate request. -7, --pkcs7 Provides PKCS#7 wrap/unwrap functions. -k, --keyid Calculate key identifiers of a key or certificate. -a, --print Print a credential (key, certificate etc.) in human readable form. -p, --pub Extract a public key from a private key or certificate. -v, --verify Verify a certificate using a CA certificate. EXAMPLES
Generating a CA Certificate The first step is to generate a private key using the --gen command. By default this generates a 2048-bit RSA key. pki --gen > ca_key.der This key is used to create the self-signed CA certificate, using the --self command. The distinguished name should be adjusted to your needs. pki --self --ca --in ca_key.der --dn "C=CH, O=strongSwan, CN=strongSwan CA" > ca_cert.der Generating End-Entity Certificates With the root CA certificate and key at hand end-entity certificates for clients and servers can be issued. Similarly intermediate CA cer- tificates can be issued, which in turn can issue other certificates. To generate a certificate for a server, we start by generating a pri- vate key. pki --gen > server_key.der The public key will be included in the certificate so lets extract that from the private key. pki --pub --in server_key.der > server_pub.der The following command will use the CA certificate and private key to issue the certificate for this server. Adjust the distinguished name, subjectAltName(s) and flags as needed (check pki --issue(8) for more options). pki --issue --in server_pub.der --cacert ca_cert.der --cakey ca_key.der --dn "C=CH, O=strongSwan, CN=VPN Server" --san vpn.strongswan.org --flag serverAuth > server_cert.der Instead of storing the public key in a separate file, the output of --pub may also be piped directly into the above command. Generating Certificate Revocation Lists (CRL) If end-entity certificates have to be revoked, CRLs may be generated using the --signcrl command. pki --signcrl --cacert ca_cert.der --cakey ca_key.der --reason superseded --cert server_cert.der > crl.der The certificate given with --cacert must be either a CA certificate or a certificate with the crlSign extended key usage (--flag crlSign). URIs to CRLs may be included in issued certificates with the --crl option. SEE ALSO
pki --gen(1), pki --self(1), pki --issue(1), pki --signcrl(1), pki --req(1), pki --pkcs7(1), pki --keyid(1), pki --print(1), pki --pub(1), pki --verify(1) 5.1.1 2013-07-31 PKI(1)